CVE-2003-0791 json
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the strin…
published 2003-10-07 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0782
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
The Script.prototype.freeze/thaw functionality in Mozilla 1.4 and earlier allows attackers to execute native methods by modifying the string used as input to the script.thaw JavaScript function, which is then deserialized and executed.
Patch / fix
- securityfocus.com/advisories/6979 advisory
- osvdb.org/8390 advisory
- securityfocus.com/bid/9322 advisory
- bugzilla.mozilla.org/show_bug.cgi?id=221526 advisory
Exploit prediction
2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
securityfocus.com
/advisories/6979
vendor-advisory, broken-link, patch, third-party-advisory, vdb-entry
-
osvdb.org
/8390
vdb-entry, broken-link, patch, vendor-advisory
-
securityfocus.com
/bid/9322
vdb-entry, broken-link, patch, third-party-advisory, vendor-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=221526
issue-tracking, patch, vendor-advisory
-
mandriva.com
/security/advisories?name=MDKSA-2004:021
vendor-advisory, broken-link
-
secunia.com
/advisories/11103/
third-party-advisory, url-repurposed
Sources
- CVE List CVE-2003-0791
- NVD CVE-2003-0791
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.